Privacy Policy

Undrop ("Undrop," "we," "us") is operated by a solo, Philippines-based developer. This page explains what we collect when you use the Undrop service — the MCP proxy, the control-plane API and dashboard, and related tools — and why. If something here is unclear, email raymund.adrian.rafael@gmail.com and ask; that goes to the person who wrote this policy, not a support queue.

The short version

We log the SQL statements your agent sends and the row counts they affect, so we can classify and show you what was blocked. We do not log, cache, or persist query result sets — the actual rows your database returns pass through to your agent and are never written to disk on our side. That's an architectural boundary, not a promise we could quietly walk back: the gateway process that proxies your queries holds no object-storage credentials, so there is nowhere for a result set to go even if we wanted to keep one.

What we collect

Account information

Email address and authentication data when you sign up. If you pay for Pro, billing details are collected and processed by Creem, our merchant of record — we receive a customer and subscription identifier, never your card number.

Database connection details

When you connect a Supabase project, we store a scoped Postgres credential (never your service_role key — the connect flow rejects it outright) encrypted at rest.

Statements, reasons, and row counts

Every statement your agent sends through the proxy is classified (allowed, blocked-destructive, blocked-unknown) and the classification, the reason codes, and affected-table row counts are stored so we can show you what was blocked and why. The exact statement text for a blocked statement is stored so you can review it before approving — this is the same text your agent sent, never a summary or a re-parse.

Snapshots

Before a risky or destructive statement runs (including ones you approve), we capture a pre-image of what it would change. Full-database, whole-table, and pre-restore snapshots are scoped pg_dump custom-format archives, readable with pg_restore. When your agent changes a code object — a function, view, materialized view, or trigger — the pre-image is the previous definition, stored as a plain .sql file readable with psql. Snapshots are encrypted at rest and stored in object storage (Amazon S3). Both formats are standard and exportable at any time — not a proprietary format we could hold hostage.

What we don't collect

Query result sets. The contents of tables we haven't snapshotted. Your agent's conversation with you or with its model provider — Undrop sees the SQL your agent decided to run, nothing upstream of that decision.

Who else sees it

We use a small number of infrastructure providers to run the service, each with access limited to what their function requires:

• Supabase — hosts our control-plane database (accounts, projects, blocked-statement records) and provides the sign-in and password-reset service for the dashboard.
• Creem — payment processing and merchant-of-record billing for Pro subscriptions.
• Amazon S3 — encrypted snapshot storage.
• AWS KMS — encryption key management for credentials and snapshots.
• Resend — transactional email.

We don't sell data, and we don't share it for advertising.

Retention

Snapshot retention follows your plan: Free keeps your last three risk-point snapshots or 24 hours of history, whichever is more; Pro keeps 30 days. If you cancel Pro, existing snapshots remain downloadable for 30 days before deletion. If you delete your account, snapshots and stored credentials are purged within 7 days, and we email confirmation once that's done.

Your rights

You can export everything, at any time — not just at cancellation. Snapshots are standard pg_dump archives and plain .sql files, so they restore without us, and you can start an export yourself from your account. You can request access to, correction of, or deletion of your account data by emailing raymund.adrian.rafael@gmail.com. If you or your end users are in the EU/EEA, a Data Processing Agreement is available on request.

Security

Credentials and snapshots are encrypted at rest via envelope encryption (AWS KMS). Database roles Undrop creates are scoped to the minimum grants needed for the proxy and snapshot engine to work, and we explicitly revoke access to Supabase's auth and storage schemas rather than relying on default grants. If our control plane goes down, write operations fail closed — an outage on our end never means an unprotected agent.

Children's privacy

Undrop is a developer tool and is not directed at, or knowingly used to collect information from, children.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, we'll email account holders and update the date at the top of this page.

Contact

Questions about this policy: raymund.adrian.rafael@gmail.com.